From: Lidong Yan <yldhome2d2@gmail.com>
Date: Tue, 22 Jul 2025 16:11:11 +0000 (+0200)
Subject: patch 9.1.1580: possible memory leak in vim9type.c
X-Git-Tag: v9.1.1580^0
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=13e1af7de9daba5f617d24295b8aaf894bf8c201;p=thirdparty%2Fvim.git

patch 9.1.1580: possible memory leak in vim9type.c

Problem:  possible memory leak in vim9type.c
Solution: Free tuple_types_ga if there was an error in
          type_type_add_types() (Lidong Yan)

In parse_type_tuple() at src/vim9type.c, we allocate memory
in `tuple_types_ga` by ga_grow(), but forget to free it when
tuple_type_add_types() fails. Replace `return NULL` with `goto on_err`
to fix leak.

closes: #17820

Signed-off-by: Lidong Yan <yldhome2d2@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/version.c b/src/version.c
index b5e0da2a2c..fa2ebcda98 100644
--- a/src/version.c
+++ b/src/version.c
@@ -719,6 +719,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1580,
 /**/
     1579,
 /**/
diff --git a/src/vim9type.c b/src/vim9type.c
index 62e9344ef9..1a20d9bd0d 100644
--- a/src/vim9type.c
+++ b/src/vim9type.c
@@ -1886,8 +1886,10 @@ parse_type_tuple(
     ret_type = alloc_tuple_type(typecount, type_gap);
     ret_type->tt_flags = flags;
     ret_type->tt_argcount = typecount;
-    if (tuple_type_add_types(ret_type, typecount, type_gap) == FAIL)
-	return NULL;
+    if (tuple_type_add_types(ret_type, typecount, type_gap) == FAIL) {
+	ret_type = NULL;
+	goto on_err;
+    }
     mch_memmove(ret_type->tt_args, tuple_types_ga.ga_data,
 						sizeof(type_T *) * typecount);